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FIG. 3 
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BUILD PARSING RULES 
BY DEMONSTRATION AND 

CLASSIFICATION AS 
POSITIVE OR NEGATIVE 
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USE BUILT PARSING RULES 
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i 

SAVE BUILT PARSING 
RULES AS TEMPLATES 
FOR FUTURE USE 
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FIG. 5 
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<?xml version="1.0" encoding="UTF-8"?> 
<schema targetNamespace="http://OutputStructure.xsd n > 
<element name="OutputStructure n > 
<complexType> 

<sequence> 

<element ref="Fields" maxOccurs="unbounded"/> 
</sequence> 

<attribute name="separator" use="required" type="string"/> 
<attribute name="hashing" use="optional" type="string M /> 
</complexType> 
</element> 

<element name="Fields"> 
<complexType> 

<sequence> 

<element ref="GroupsMsgDataElement" minOccurs="O n 
maxOccurs= u rV> 

<element ref="RuleAttCreationTime M /> 
<element ref="RuleAttSeverity"/> 
</sequence> 

<attribute name="Match" type="string"/> 
<attribute name="Substitute n type="string"/> 
<attribute name="Split" type="string n /> 
<attribute name="Name n type="string"/> 
<attribute name="DescriptiorT type=' < string ,, /> 
</complexType> 
</element> 

<element name= ,< RuleAttCreationTime M > 
<complexType> 

<sequence> 

<element ref="Subs" minOccurs="r 

maxOccurs="unbounded"/> 

</sequence> 

<attribute name="Value M type="string" use="optionar/> 
</complexType> 
</element> 

<element name="Subs"> 
<complexType> 

<attribute name="Positions" type="string n /> 

<attribute name="Match" type="string"/> 

<attribute name="Substitute M type="$tring"/> 

<attribute name= lt TimeFormat n type="string"/> 

</complexType> 

</element> 

</schema> 
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